NexusSec.Firewall rule bases grow one urgent request at a time and almost never shrink. An audit once a year keeps the policy readable and catches the settings that attackers look for first.
The rule base
1. Unused rules
Check hit counters over a period that includes month-end and other busy cycles. Rules with no hits are candidates for removal. Disable them first with a dated comment, then delete them after an agreed period if nothing breaks.
2. Over-broad rules
Look for rules that allow any source, any destination or any service, especially between internal zones or from the internet. Replace them with rules that name what is actually needed.
3. Shadowed and duplicate rules
A shadowed rule never matches because a broader rule above it catches the traffic first. Duplicates do the same job twice. Both make the policy harder to read and hide mistakes.
4. Rule order
Firewalls usually match rules from the top down. Check that specific deny rules sit above broader allow rules, and that the policy ends with a default deny.
5. Temporary rules that became permanent
Rules added for a project, a vendor visit or troubleshooting often stay forever. Give temporary rules an expiry date in the comment, or use the firewall's scheduling feature where it has one.
6. Rules without an owner
Every rule should say who asked for it and why. If nobody can explain a rule, it goes on the list for review.
The firewall itself
7. Admin access
Management should be reachable only from trusted internal networks, never from the internet, with named accounts rather than a shared admin login, and MFA where the firewall supports it.
8. Firmware and advisories
Compare the running firmware with the vendor's current recommended release and its security advisories. Edge devices are a favourite target, as covered in firewall edge attacks.
9. Services exposed on the internet side
Check which portals and services answer on WAN interfaces: admin pages, user portals, SSL VPN and remote management. Turn off what is not needed and restrict the rest.
10. Logging and time
Confirm the firewall logs allowed and denied traffic, sends logs off the box, keeps them long enough, and has correct time from a reliable time source. See CERT-In log retention for the 180-day requirement.
11. VPN settings
Check for legacy encryption settings, shared or weak pre-shared keys, VPN accounts belonging to people who have left, and remote access without MFA.
12. Configuration backups and change records
Keep a recent configuration backup off the firewall, and a record of what changed, when and why. Without them, a failed appliance or a bad change becomes a long outage.
How often to audit
At least once a year, and after major changes such as a firewall replacement, a new site or a merger. Planning zones first, as described in zone-based firewall policy, makes each audit faster than the last.
What to do with the findings
Fix internet-facing items first: exposed admin pages, old firmware and over-broad inbound rules. Then clean up internal rules in planned change windows, with a rollback for each change. Our firewall audit and rule review gives you a prioritised clean-up plan, grouped into immediate risks, clean-up opportunities and architectural recommendations.
